Rippling's Chinese AI Model Controversy Exposes a Blind Spot Every Business Shares

TL;DR: Rippling's use of a U.S.-blacklisted Chinese AI model shows how far corporate AI adoption has outrun verification, and it's a problem every team using AI tools should take seriously.

When the Daily Caller News Foundation reported on October 24 that Rippling, a San Francisco HR and payroll platform serving more than 20,000 U.S. companies, had used an AI model from a Chinese firm on a U.S. government blacklist, the story landed as a political shocker. But strip away the partisan angles and you're left with a question that should make any manager, developer, or business owner uncomfortable: do you actually know what's inside the AI tools your vendors use? Rippling's primary AI models remain OpenAI and Anthropic offerings, and the company says it bars AI providers from storing or training on client data. Still, the episode shows how quickly modern AI adoption moves, and how rarely anyone verifies what's been adopted.

What Actually Happened

Here's the timeline as reported. In January 2026, the Commerce Department's Bureau of Industry and Security added Zhipu, which operates as Z.ai, to its Entity List, citing the firm's role in aiding China's military modernization. In July, Rippling CEO Parker Conrad publicly credited Zhipu's GLM 5.2 on X, describing it as roughly 85% cheaper than frontier closed models with nearly identical performance. Rippling President Matt MacInnis also published internal benchmark results covering 15 model variants tested against real-world business agent tasks, and CTO Albert Strasheim reportedly used GLM 5.2 for an internal security review in August. Neither Rippling nor Zhipu responded to requests for comment from the reporting outlet. Some of Rippling's customers operate in defense and national security, which raises the stakes considerably, and that's what turned an engineering decision into a national security story.

The Entity List Gap Nobody Explains to Buyers

Here's the part most coverage glosses over. Entity List placement restricts U.S. exports of technology to the listed firm. It does not outright ban American companies from using that firm's models. That gap is the whole debate. A company can adopt a listed vendor's AI model and remain technically compliant while its data, prompts, and inference traffic potentially transit infrastructure the U.S. government has flagged. AEI fellow Ryan Fedusiak argued in the Daily Caller piece that this scenario risks deliberate data exfiltration and intelligence collection, calling it potentially far worse than TikTok because HR platforms hold sensitive personal and professional information. He also warned that open-weight models can be tampered with in hard-to-detect ways. Those attacks remain rare, but the potential is real, and auditing a model you didn't build is genuinely hard.

The Cost Pressure Is Real, and That's the Problem

It would be easy to write this off as one company's bad judgment. It isn't. Chinese labs including Zhipu and Alibaba have released open-weight models that approach frontier performance at a fraction of the price, and that pricing pressure is reshaping the market. Airbnb's CEO publicly said last year that his company used Alibaba's Qwen model because it was fast and cheap. DoorDash and a wave of smaller startups have made similar moves, per the same reporting. When a credible internal benchmark suggests you can get nearly identical output for 85% less money, someone in your organization will ask why you're paying premium prices. The answer shouldn't be fear. It should be evidence. The problem is that most of that evidence lives inside private companies, where nobody outside can check it.

Private Benchmarks vs. Benchmarks Anyone Can Check

Rippling's 15-variant internal benchmark is one of the more detailed corporate validations of open-weight economics you'll find publicly. But notice the word internal. You can't reproduce it, inspect the methodology, or see whether the tasks were fair. That's not a knock on Rippling specifically. It's how the whole industry works: vendors and buyers run tests behind closed doors, publish the conclusions, and expect everyone to trust the process. There's a better pattern, and it's the one we apply at SkillzBench for agent skills. Every skill in our free directory is pinned to a specific commit SHA, validated, license-checked, security-scanned, and quality-judged. Then we benchmark each one in a sandbox using the same model, with the skill and without it, and publish the resulting Lift in percentage points. Anyone can look at the numbers. Trust scores (0 to 100, built from security, quality, license, maintenance, and community signals) are always shown separately from performance, so a cheap but risky option can't hide behind a good benchmark result, and money never touches either number.

You Inherit Your Vendors' AI Choices

The most unsettling part of this story for a typical business owner is this: you probably use a dozen SaaS tools, and every one of them is quietly making AI decisions on your behalf. If your payroll platform, your CRM, or your help desk vendor swaps in a cheaper model, you'll likely never hear about it. Defense contractors and other sensitive-sector firms learned this the hard way this week when reporting highlighted that their HR vendor had been testing a blacklisted Chinese model. The lesson generalizes. Ask your vendors which models they use, where inference traffic goes, whether client data trains anything, and what happens if a model or provider changes. If they can't answer in writing, that's your answer. And if you're building your own agent workflows, apply the same discipline to the components you bolt on. Published research has found that roughly 26% of agent skills carry at least one vulnerability, which means the supply-chain problem isn't limited to foundation models. It extends all the way down to the SKILL.md instruction packages running inside Claude Code, Cursor, Codex, Gemini CLI, and chat-app agents.

What Sensible Due Diligence Looks Like

You don't need a security team to do this right. A short checklist covers most of it. Pin the exact version of anything you adopt, so you know what was reviewed. Check the license before you ship. Run a security scan, or use a tool that already did. Prefer evidence from reproducible tests over vendor claims. Keep performance and trust separate in your evaluation, because a tool can be fast, cheap, and dangerous all at once. And track upstream changes, because the thing you approved last quarter may not be the thing running today. That's the same discipline SkillzBench applies across its free directory: every skill version is pinned to a commit, scanned, and re-benchmarked when upstream code changes, with alerts when something shifts under you. If you want to go further, the free MCP connector and per-agent loadouts let you toggle exactly which skills and tools each of your agents can see, so nothing runs in your stack that you didn't explicitly choose. Everything on the platform, including the directory, benchmarks, and alerts, is free, and you can find current numbers and verified results at skillzbench.com.

Bottom line

The Rippling story will keep generating headlines because of its political angles, but the underlying issue is bigger than one company or one model. AI adoption is moving faster than AI verification, and the gap between those two is where risk lives, whether the component in question is a foundation model from a blacklisted lab or a free skill package downloaded from GitHub. Companies will keep chasing cheaper models, and honestly, the economics suggest they should. The fix isn't to stop adopting. It's to demand the same transparency from your AI supply chain that you'd demand from any other vendor: pinned versions, published tests, independent scans, and scores that don't move when money does. That standard exists today for agent skills. Hold everything else to it.

Key takeaways

• Rippling, an HR platform serving over 20,000 U.S. companies, tested Zhipu's GLM 5.2, a model from a firm added to the U.S. Entity List in January 2026.
• Rippling's CEO publicly claimed the model was roughly 85% cheaper than frontier closed models with nearly identical performance.
• Entity List rules restrict exports to listed firms but don't clearly ban American companies from using their models, leaving a compliance gray zone.
• The core risk is data governance and auditability, and buyers often inherit their vendors' AI choices without knowing it.
• Independent, public verification and benchmarking, like SkillzBench's free approach for agent skills, is the practical answer to adoption outpacing scrutiny.